AZ-700 Question 49
Select 2You manage a hub-and-spoke architecture in Azure. You have an NVA firewall in the hub and an ExpressRoute gateway for on-premises connectivity. You need to ensure that all internet-bound traffic from a spoke subnet passes through the NVA for inspection, while traffic destined for on-premises networks goes over ExpressRoute. Which User-Defined Route configurations should you implement on the spoke subnet� route table?
- A
Create two default routes: one with next hop type 'Virtual Appliance' pointing to the NVA, and another with next hop type 'Internet' to allow direct access to the internet instead of using the NVA.
- B
Create a 0.0.0.0/0 route with next hop type 'Virtual Appliance' pointing to the NVA, and a specific route for the on-premises address range with next hop type 'Virtual Network Gateway'.
- C
Create a specific route for the on-premises IP range with next hop type 'Virtual Appliance', and do not configure any default route in the subnet� UDR.
- D
Associate a route table with this subnet that has a 0.0.0.0/0 route with next hop type 'Virtual Appliance' pointing to the NVA and a route for the on-premises address range with next hop type 'Virtual Network Gateway'.
Show answer and explanation
Correct answers: B, D
Explanation
When configuring user-defined routes for a spoke subnet that requires both on-premises connectivity (via ExpressRoute) and internet-bound traffic inspection (via an NVA), you must create a specific route for the on-premises IP ranges pointing to 'Virtual Network Gateway' and a default route (0.0.0.0/0) pointing to the NVA. This ensures that only external traffic is routed to the firewall, while on-premises traffic goes over ExpressRoute. For more details, refer to the official Microsoft documentation on custom routes and next hop types: https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview.
- A. Incorrect.
Incorrect. Having two default routes (one to the NVA and another directly to the Internet) creates conflicting rules for outbound traffic and does not correctly direct on-premises traffic to the ExpressRoute gateway.
- B. Correct.
Correct. A default route to the NVA (0.0.0.0/0) ensures all internet-bound traffic is inspected by the firewall. A specific route to the on-premises IP range with next hop type 'Virtual Network Gateway' forces on-premises traffic through ExpressRoute.
- C. Incorrect.
Incorrect. Without a default route, internet-bound traffic would follow the system routing, bypassing the NVA firewall. Also, routing on-premises traffic to the NVA does not utilize ExpressRoute as intended.
- D. Correct.
Correct. This configuration explicitly routes internet-bound traffic to the firewall (default route to NVA) while ensuring traffic to on-premises ranges is sent via the ExpressRoute gateway.